build: optimized Bazel repository and toolchain caching for CI

- Pin Rust toolchain component checksums in MODULE.bazel to enable Bazel's repo contents cache.
- Opt MSVC LLVM tools, XWin sysroot, and Zig repositories into reproducible repo metadata caching.
- Extend GitHub Actions cache paths to include the Bazel repository download and contents cache.

.github/actions/bazel-cache/action.yml

@@ -77,7 +77,14 @@ runs:
         if: steps.backend.outputs.remote != 'true'
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
-           path: ~/.cache/omp-bazel-disk
+           # Both caches ride one archive: the action cache AND the repository
+           # cache (downloads + extracted repo contents at repo/contents, which
+           # reproducible repo rules reuse across output bases). Without the
+           # repo half, every hosted job re-downloaded and re-extracted the
+           # rust/LLVM/zig toolchains. Save sites must list the same paths.
+           path: |
+              ~/.cache/omp-bazel-disk
+              ~/.cache/omp-bazel-repo
            key: ${{ steps.backend.outputs.cache-key }}
            # Order matters: exact key, same-config prefix, then any archive for
            # this scope+os+arch. The bare fallback is what keeps release version
@@ -130,7 +137,10 @@ runs:
              # generations wrote would otherwise ride along forever; drop
              # anything untouched for 14 days (tar preserves mtimes across
              # the actions/cache round trip, so age survives restores).
-             find "$HOME/.cache/omp-bazel-disk" -type f -mtime +14 -delete 2>/dev/null || true
+             # Covers the repo download/contents cache too — bazel's own
+             # contents-cache GC only runs on idle servers, which short-lived
+             # CI invocations never have.
+             find "$HOME/.cache/omp-bazel-disk" "$HOME/.cache/omp-bazel-repo" -type f -mtime +14 -delete 2>/dev/null || true
              {
                echo "common --config=ci"
                echo "common --disk_cache=$HOME/.cache/omp-bazel-disk"